https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:38:41.163583+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-20871 cnvd-2025-20871 2026-10-03T08:38:41.293471+00:00 cnvd-2025-20871 https://cve.radiocsirt.org/vuln/euvd-2026-259984 EUVD-2026-259984 2026-10-03T08:38:41.293523+00:00 EUVD-2026-259984 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53192 fkie_cve-2025-53192 2026-10-03T08:38:41.293553+00:00

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.

This issue affects Apache Commons OGNL: all versions.

When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

 https://cve.radiocsirt.org/vuln/ghsa-5vgh-76mj-8hcq GHSA-5vgh-76mj-8hcq 2026-10-03T08:38:41.293626+00:00

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.

This issue affects Apache Commons OGNL: all versions.

When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15567-1 openSUSE-SU-2025:15567-1 — mybatis-3.5.19-1.1 on GA media 2026-10-03T08:38:41.293686+00:00

mybatis-3.5.19-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2025:03285-1 SUSE-SU-2025:03285-1 — Security update for mybatis, ognl 2026-10-03T08:38:41.293720+00:00

Security update for mybatis, ognl

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-53192 UBUNTU-CVE-2025-53192 2026-10-03T08:38:41.293755+00:00

Affected: Ubuntu:16.04:LTS: ognl, Ubuntu:18.04:LTS: ognl, Ubuntu:20.04:LTS: ognl, Ubuntu:22.04:LTS: ognl, Ubuntu:24.04:LTS: ognl, Ubuntu:25.10: ognl, Ubuntu:26.04:LTS: ognl

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.